Encryption Fundamentals

Hugo Fruehauf
hxf@zyfer.com October 2001

Securing Data through a Cryptographic Process
Sender
Data Packet Encryption Key 101010011100100100100101001000100010 101001010010010100101001001010010100100 Packet length, however long Encryption Key (i.e. 128 bits) Packet chopped into Key length sections If too short, pad with ‘0s’ to the key length

Encrypted Data

000110001001001000010010000100000100000

Network

Receiver
128 bit StealthKey

Encrypted Data Same Key for Decryption Data Packet

000110001001001000010010000100000100000 101001010010010100101001001010010100100 101010011100100100100101001000100010
9-01

Cryptographic Algorithms
• • • Cryptography allows two parties to exchange sensitive information in a secure manner. Encryption scrambles the information so that only the intended recipient can recover the original information by decrypting it. Two types of cryptographic algorithms
– Symmetric (Secret-Key) algorithms – Asymmetric (Public-Key) algorithms

Cryptography can also provide the following security properties
– Authentication - authenticates the party that sent the information. – Integrity - assures that the information was not modified while in transit. – Non-repudiation - disallows a party denying a previous message or action.
6-01

Symmetric (Secret-Key) Cryptography
Sender
Unencrypted Data

Encryptor Key

Encrypted Data

Must Be Given To Receiver (RF, Wire, Fiber, Physical, etc.)

Communications Media

Receiver

Key

Red Unencrypted Data Data

Decryptor

Encrypted Data

6-01

Symmetric Key Pros and Cons
• Pros: – Fast – Easy to implement in hardware – Widely used Cons: – Secret key must be exchanged via a trusted (secure) channel – Most have fixed key length – Can be intercepted if poor algorithm is used – Requires added effort for authentication of sender – Key administration logistics A new key must be created and kept for every new party that exchanges information: • • • • 2 parties = 1 key 3 parties = 3 keys 4 parties = 6 keys 5 parties = 10 keys
n2 − n 2

6-01

Asymmetric (Public-Key) Cryptography
• Public Key Infrastructure (PKI) definition – A policy for establishing a secure method for exchanging information within an organization, an industry or a nation. It includes the cryptographic methods, the use of digital signatures, digital certificates and certification authorities (CAs) and the system for managing the process. • • • • Provides enterprise-wide security and authentication Administers security once for all network applications across all platforms Provides security consistently Builds a “trusted” network environment

6-01

Hierarchical PKI Model
Signing Certificate for specific policy created Authority Signing (Off-line) Point of authentication

Point of authentication Root Authority (Off-line)

Secure Root and Infrastructure Certificate created

Customer CA CA - Certification Authority RA - Registration Authority

Secure communications with other CAs

Point of authentication

Customer RA

Point of verification

Network Secure Transactions

6-01

Registration and Certification Process
Complete Application Generate Key Pair 2

3 Applicant 4 Send to RA Create 6 Certificate Request 1 Deliver Certificate Application

5 Review Application Registration Authority 7 Send to CA 8 Generate Certificate
Name Org Key Signature Date

Send 9 Certificate to Applicant

Certificate Issuer

6-01

Basics of Asymmetric (Public-Key) Cryptography
• PKI (simplified)
Receiver’s Public Key (B) Network Encrypt Decrypt Data to be Encrypted

Public Key Data Base Public Key (B)

Private Key (B)

Decrypted Data

Sender (A)

Receiver (B)

• Usable mainly for relatively low data rates because asymmetric cryptography is math intensive which slows down the pipe
9-01

Symmetric Key Exchange via PKI
• PKI (simplified)
Receiver’s Public Key (B) (A) Generates Symmetric Key Network Encrypt Decrypt Encrypt Decrypt Data to be Encrypted Private Key (B) Symmetric Key Rcv’d Public Key Data Base Public Key (B)

Sender (A)

Decrypted Data

Receiver (B)

• Using symmetric key transferred to receiver via PKI, now system is ready for high data rates, no key resolution math, just the encryption algorithm which should not to slow the pipe
6-01

Public-Key vs. StealthKey Infrastructure
• PKI (simplified)
Public Key (B) (A) Generates Symmetric Key Network Encrypt Decrypt Encrypt Data Data Decrypt

Sender

Receiver
Public Key (B) Private Key (B) Symmetric Key Rcv’d

• Simplified StealthKey™ for comparison
Independently Generate Symmetric Keys Independently Generate Symmetric Keys

Data

Encrypt

Network

Decrypt

Data

Key Management - The n2 Problem

If there are ‘n’ people communicating, there needs to be (n2-n)/2 keys!
n2 − n 2 102 − 10 2

n

10 100

=

100 − 10 2 10,000 − 100 2 40,000 − 200 2

=

90 2

=

45

100 − 100 2
2

= =

9,900 = 2 39,800 = 2

=

4,950 19,900

200

200 − 200 2
2

=

Source: SU and SAIC (modified) 10-01

Key Exchange Logistics
35000
Amy

No. of Symmetric Keys (Kn)

30000 25000 20000 15000 10000 5000 0 50 100
Henry KGH Gina KAH KBH KCH KDH KFH KFG Frank KEF KEH

KAB Barry KBC Cathy KCD Don KDE Earl

K(n)=

n2 - n 2

150

200

250

Number of People Communicating

PKI with Data and Sender Authentication
Certification Authority (CA) Public Key for a person is mathematically associated with the Private Key for that person. Encrypted (Black Data) Black Data Sent Network Encrypted (Black Data)

Receiver’s Public Key

Receiver’s Private Key

Decrypted (Red Data)

+

=

+

=

Decrypted (Red Data)

HASH Sender’s Private Key

HASH

Encrypt

Decrypt

Data Authentication

Sender’s Public Key

Sender

Receiver
6-01

Diffie-Hellman Infrastructure
• D-H Key Exchange
IN THE CLEAR

Public Key A
Network

Public Key B

Private Key A

Diffie Hellman Math

Public Key B

Public Key A

Diffie Hellman Math

Private Key B

Generate Symmetric Key

Encrypt

Network

Decrypt

Generate Symmetric Key

Data In

Data Out

6-01

Today’s Cryptography Systems (Simplified)
“Setup” Phase
Get Keys 1 Request 2 Receive

User #1 5 Store Keys in Terminal

CA
Public Data Base

Get Keys User #2

3 Look up User #2 Public Key 4 Receive User #2 Public Key 6

“Use”-Phase

Symmetric Key Data 7 Encrypt 8 Asymmetric Transfer

9

Private Key Decrypt

10 11 Acknowledge Receipt Symmetric Key

Data 12 13 Encrypt 14 Symmetric Transfer

Network

15 Decrypt

16 Data Out

“Repeat Setup” Phase

Get Keys Or Generate New Keys Via CA

17

& 18 Request/Receive New Keys Store in Terminal Etc. 6-01

19

StealthKeyTM Cryptography Infrastructure
“Setup” Phase
Get Setup 1 Receive Setup Authorized Agency Receive Setup Get Setup User #2 Store In Chip

User #1 2 Store In Chip

Secured Data Base

3

“Use”-Phase

Symmetric Key Seq’s

3

Symmetric Key Seq’s

5 4

Encrypt

6

Symmetric Transfer

7 Decrypt

Data In

8

Data Out

Network

“Repeat Setup” Phase

6-01

RSA - Public Key Infrastructure Details
4 3 RSA Public Key Database 2 RSA Receiver Private Key 9 8 RSA Decrypt 1 RSA Public & Private Key Generation (Receiver) 10 Symmetric (Secret) Key 18 16 Decrypt

Sender

5 Symmetric (Secret) Key Generation

RSA Receiver Public Key

Receiver

11 Message 13 Timestamped Message 12 Timestamp

6 Symmetric (Secret) Key 14 Encrypt RSA Encrypt

7

21 Message 20 Timestamped Message 19

Message Digest Generation (HASH)

Network

15

17

Message Digest Generation (HASH) Message Digest Compare RSA Decrypt

Timestamp

Data Transfer Authentication - Sender - Receiver - Data Integrity 22 RSA Public & Private Key Generation (Sender) RSA Sender Private Key 24 RSA Public Key Database 27 RSA Sender Public Key 25 RSA Encrypt 26 28 29 Authentication (Y/N)

23

6-01

Asymmetric Keys Pros and Cons
• Pros: – Does not require a trusted (secure) channel – Inherently provides authentication of sender – Variable key lengths Cons: – Computationally intensive, not usable for high speed applications – Not easily implemented in hardware – Authentication of public keys – Key administration logistics – Asymmetric algorithms mathematically relate two keys materials - a public and private key pair – The public key is in the open domain – The private key is protected by a password in a secure location, usually in a PC, smart card or floppy – The public key is generally used to encrypt data and the mated private key for decrypting data
6-01

Role of Certification Authority

Certification Authorities (CA) establish the validity of certificates, allowing an identity to be bound to a public key and providing confidence that the binding is valid. CAs issue, manage, and revoke certificates for the user communities. Certification Authorities – Validate identity of certificate subject (to various degrees) – Certify certificates with CA digital signature – Enforce certificate validity – Maintain a certificate revocation list (CRL) – Generate Key Pairs

• •

Source: Chokhani, S., Ford, W., “Internet Public Key Infrastructure: Certificate Policy and Certification Practices Framework,” IETF Internet Draft, draft-ietf-pkix-ipki-part4-02.txt, 30 September 1997.

6-01

Digital Signatures
• Digital Signatures: – An authentication mechanism that enables the creator to attach a code that acts as a Signature. The signature guarantees the source and integrity of the file. – Provides authenticity and integrity. • Authenticity or Source: The sender of the information is who he says he is. • Integrity: The information sent has not been changed during the transmission. • Encryption vs. Digital Signatures – Encryption solves: • Confidentiality • Access Control – Digital Signature solves: • Information Integrity • Authentication • Non-Repudiation

6-01

Digital Signatures
• Creation: – Hash the data object to be signed. – Encrypt the hash with your private key. – Transmit both the data object, public key and the encrypted hash. • Verification – Hash the data object received. – Decrypt the encrypted hash with senders public key. – Compare the computed hash with the decrypted hash.

6-01

Spoofing Attacks

Need for binding A to A’s public key
A’s private key A A’s public key X’s private key X’s public key B

X A’s public key X’s public key “Send me A’s public key”

B

6-01

Cost and Time to Break DES Keys
Time to Break Key
Type of Attacker Budget 40-Bit 56-Bit 168-Bit 3DES

Individual Hacker

$400

5 Hours

38 Years

Too long

Dedicated Hacker

$10,000

12 Minutes

556 Days 22 Hrs* 21 Minutes

1019 Years

Intelligence Community

$10 Million

0.02 Sec.

1017 Years

(Source: “Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security.” Blaze, et.al. 1/96; Schneier B. “Applied Cryptography, Second Edition” John Wiley & Sons, Inc. 1996) * IPSec, Naganand Doraswamy, Prentice-Hall, 1999
6-01

StealthKey™ Encryption Layer Options StealthKey
OSI
7 Application (Payload) 4 6 Presentation

Internet DATA
Application Layer (Payload)

Packet 32 Bit OH needed

128

128 OH+P

5 4

Session Transport

3

Host to Host (Transport Layer)

OH may not be needed A B IPSec

TCP

128

128

Pad

TRANSPORT MODE ESP A B ESP IP TCP DATA TUNNEL MODE TCP DATA

Encrypt Shim Options

3

Network

2

InternetWorking Layer

IP C D IP

2 1

Data Link Physical

Network I/O 1 (Network Access Layer)

NAL IP ESP

IP

TCP

DATA

NAL
6-01

Packet Loss 15% 25% 30% 35% 40% 10% 20% 45% 5% 0%
Round Trip Latency (ms)
6-01

AM

Noon

PM
Midnight

Early AM
AM

Noon

PM

Internet Performance

Midnight
Early AM

AM

1000

1500

2000

2500

0

500